CVE-2026-120415: 
JavaScript vulnerability analysis and mitigation

CVE-2026-120415 is a cross-origin credential disclosure vulnerability in the Node.js HTTP client library undici, caused by a bypass of the redirect header-stripping mechanism when request headers are supplied as an array of [name, value] tuples. The flaw allows sensitive headers (e.g., Authorization, Cookie, Proxy-Authorization) to be forwarded to unintended cross-origin redirect destinations. Affected versions are >= 7.0.0, < 7.30.2 and >= 8.0.0, < 8.12.4. It carries a CVSS v3.1 base score of 5.9 (Moderate) (GitHub Advisory).

The root cause is a representation-dependent parsing bug (CWE-200, CWE-212) in undici's redirect interceptor. When headers are passed as an array of [name, value] tuples (e.g., via Object.entries(headers)), the redirect handler incorrectly interprets them as a flat [name, value, name, value, ...] list, causing header name comparisons to fail and preventing sensitive headers from being stripped on cross-origin redirects. If a header-normalizing interceptor such as cache() or deduplicate() is composed outside redirect(), it serializes the retained sensitive headers onto the outgoing cross-origin request. This is a representation-dependent bypass of the fix introduced for CVE-2024-30260 (GitHub Advisory).

Successful exploitation results in the disclosure of origin-bound credentials — such as Authorization tokens or Cookie values — to an unintended third-party server that is the destination of a cross-origin redirect. This is a confidentiality impact with no integrity or availability consequences. Applications that send authenticated requests through undici with array-of-tuples headers and follow cross-origin redirects are at risk of credential theft, which could enable account takeover or unauthorized access to protected resources (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory publication date (November 5, 2026). Exploitation requires a high attack complexity — specifically, the attacker must control or influence the redirect destination and the application must use the vulnerable header format with a specific interceptor composition. The CVE was reserved but details were published via GitHub Security Advisory GHSA-9v6h-8rgp-m69f. No EPSS score or CISA KEV catalog entry is currently available (GitHub Advisory).

1. Identify a target application: Find an application using undici versions >= 7.0.0, < 7.30.2 or >= 8.0.0, < 8.12.4 that sends credential-bearing HTTP requests with headers supplied as an array of [name, value] tuples (e.g., Object.entries(headers)).
2. Confirm vulnerable interceptor composition: Verify that the application composes a normalizing interceptor (cache() or deduplicate()) outside the redirect() interceptor, which is the prerequisite for the sensitive headers to be serialized onto the redirected request.
3. Control or influence the redirect destination: Position a server or manipulate a redirect response (e.g., via a compromised intermediate server or SSRF) so that the application's HTTP request is redirected to an attacker-controlled cross-origin endpoint.
4. Trigger the cross-origin redirect: Cause the target application to make a request to a URL that issues a cross-origin redirect (HTTP 301/302/307/308) pointing to the attacker's server.
5. Capture disclosed credentials: Collect the Authorization, Cookie, or Proxy-Authorization headers forwarded to the attacker-controlled server, which were not stripped due to the tuple-parsing bug (GitHub Advisory).

• Network: Outbound HTTP requests from the application server to unexpected third-party origins carrying Authorization or Cookie headers following a redirect chain; HTTP redirect responses (301/302/307/308) pointing to cross-origin destinations in server access logs.
• Logs: Application or proxy logs showing requests with sensitive headers forwarded to domains not matching the original request target; undici debug logs indicating redirect interception with retained sensitive headers.
• Application Behavior: Unexpected authentication failures or token invalidation events that may indicate credential reuse by a third party after credential disclosure.

Upgrade undici to version 7.30.2 or 8.12.4, which contain the fix for this vulnerability. If an immediate upgrade is not possible, apply one of the following workarounds: (1) supply request headers as a plain object or a flat [name, value, name, value, ...] array instead of an array of [name, value] tuples; or (2) ensure the redirect() interceptor is composed outside any normalizing interceptors (cache() or deduplicate()) rather than inside them (GitHub Advisory).

The advisory was published on November 5, 2026, by undici maintainer mcollina, with remediation review by UlisesGascon. The report was submitted with AI assistance, and the flaw was discovered by researchers ffasterss and shirabe0x05. No broader media coverage or notable community commentary beyond the GitHub advisory has been identified at this time (GitHub Advisory).